JPH09153896A - Communication transfer controller, network system and network management system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication transfer controller which can collectively manage information of communication permission in a large organization. SOLUTION: In the communication transfer controller 9 transferring communication between computers, a mechanism for information-converting a judgment condition or a judgment result whether communication between the computers is permitted or not between the plural communication transfer controllers is prepared. When a connection request is given to an internal computer 8a from outside, the communication transfer controller 9 connecting the network of the organization with the network of a wide band requests the judgment of connection propriety to the communication transfer controller in charge of the management of connection judgement information on the computer. Then, the result is received and communication is permitted or denied in accordance with the result. Thus, information on communication permission can collectively be managed in the large organization, and information to which combination of which computer in the organization and which computer out of the organization communication is permitted can be judged and set for respective parts in charge.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method of using a computer network, and more particularly, to a communication transfer having a function of decentralized management of communication permission / non-permission information between computers, which has conventionally required centralized management. The present invention relates to a control device, a network system, and a network management system.

[0002]

2. Description of the Related Art Conventionally, when a computer network of an organization is connected to a wide area network and communication with another organization is performed via the wide area network, which computer within the organization and which computer outside the organization are permitted to communicate with each other? Information was collectively managed by a communication transfer control device that connects an organization's network and a wide area network (see, for example, Japanese Patent Laid-Open No. 4-237252).

[0003]

The above-mentioned prior art has a drawback that communication permission information cannot be collectively managed in a large organization. In other words, in a large organization, only the administrator of the relevant computer in the organization tends to be able to determine which computer in the organization and which computer outside the organization the communication is allowed to be determined by. Was difficult.

In order to solve this problem, an object of the present invention is to determine and set information for each computer in the organization and which computer outside the organization is permitted to communicate, for each department in charge. The purpose is to simplify management by providing a mechanism to do so.

[0005]

The above-mentioned object is to provide a communication transfer control device having a mechanism for exchanging information between a plurality of communication transfer control devices for a determination condition or a determination result as to whether or not communication between computers is permitted. It is achieved by

[0006] In a network system inside an organization connected to a wide area network, information on which computer within the organization and which computer outside the organization are permitted to communicate when communication with another organization is performed via the wide area network. Information is exchanged between a plurality of communication transfer control devices, and the communication transfer control device in charge of the computer inside the organization judges whether the network inside the organization can be connected to the communication transfer control device that directly connects to the wide area network. Have a mechanism to convey.

In addition, in the network management system inside the organization connected to the wide area network, when communication with another organization is performed via the wide area network, communication between which computer inside the organization and which computer outside the organization is permitted. Whether or not the communication transfer control device that exchanges this information among a plurality of communication transfer control devices and is in charge of the computer inside the organization can connect the network inside the organization to the communication transfer control device that directly connects the wide area network. The decision to connect to the festival is made based on the information.

[0008]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a conceptual diagram of establishing a communication path on a computer network using the present invention. Currently, there are many wide area networks 6, organizational networks 7, and department LANs 8 based on TCP / IP technology such as the Internet.
A communication transfer control device 9, which is a so-called gateway or router, is installed between the wide area network 6 and the intra-organization network 7 so that the computer 8a installed inside the organization and the trading destination computer 5 can communicate with each other. The present invention also assumes the same TCP / IP-based environment and a network environment having similar functions. In the present invention, the connection request 1 (usually the outgoing IP
Address, received IP address, service number, and communication contents) is sent to the gateway, that is, the communication transfer control device 9, requests the communication transfer control device 10 in charge of management of the received IP address to determine whether or not connection is possible. (Fig. 1
If the connection is approved (decision request 2) and the connection is approved (connection approval 3 in FIG. 1), the communication path is established by transferring the communication content to the communication transfer control device 10 (communication path establishment 4 in FIG. 1).

FIG. 2 is an example of a process for determining whether or not a communication transfer control device using the present invention can be connected. Now, suppose that the connection request 1 is sent from the external computer to the communication transfer control device 9. For example, assume that the content of the connection request 1 at this time is the source IP address 192,168.11.22 and the reception IP address 133.144.33.11 service number 21. The communication transfer control device 9 searches Table 1 storing the IP address and the assigned communication transfer control device name according to the algorithm illustrated in FIG.

[0011]

[Table 1]

Table 1 is an example of a table of IP addresses and assigned communication transfer control device names, and XX in the table is a special numerical value that is determined to match any numerical value. This table 1 can be easily implemented by equipping each communication transfer control device with an appropriate storage device.

According to Table 1, the received IP address 133.144.3
The communication transfer control device in charge of 3.11 is the communication transfer control device 10 (reception IP address 133.144.33.11 is 13 in Table 1).
Since it matches 3.144.33.XX), the contents of the above connection request 1 (outgoing call I
(P address, received IP address, service number) is transferred to the communication transfer control device 10, and the communication transfer control device 10 searches Table 1 according to the algorithm also illustrated in FIG.

Now, it is assumed that the same contents as Table 1 of the communication transfer control device 9 are stored in the communication transfer control device 10 as Table 1. In this case, the communication transfer control device 10 searches Table 2 which stores the combination of the IP address and the service number for which the connection is permitted or denied.

[0015]

[Table 2]

In this case, the connection approval (source IP address 192,1
68.11.22 matches 192.168.XX.XX in Table 2, the received IP address 133.144.33.11 matches 133.144.33.XX in Table 2, service number 21 matches XX in the table, and the judgment result (Fig. The communication transfer controller 9 is notified of 1 connection approval 3). Since the connection has been approved, the communication transfer control device 9 establishes the communication path by transferring the communication content to the communication transfer control device 10 (communication path establishment 4 in FIG. 1).

In the above embodiment, for simplicity, the communication transfer control device 10 for determining whether connection is possible and the communication transfer control device 10 for transmitting communication contents are the same, but they may be different. Further, the communication transfer control device 10, which has received the connection determination request from the communication transfer control device 9 which is the gateway, immediately determines whether or not the connection is possible according to Table 2, but this configuration may have multiple stages. That is, Table 1 of the communication transfer control device 9 stores the communication transfer control device that manages information for each department, and Table 1 of the communication transfer control device that manages information for each department manages information for each section. The communication transfer control device to be stored may be stored in advance, and the actual determination may be performed in the communication transfer control device which stores the information for each section.

Further, in the above embodiment, the communication transfer control device 9, which is a gateway, is in charge of determining whether or not connection is possible when each connection request is made.
I was inquiring about the connection availability, but the communication transfer control device 1
When the setting content of 0 is changed, the changed content is transmitted to the communication transfer control device 9 which is the gateway, and when there is an individual connection request, the connection propriety may be determined based on the previously transmitted content. .

[0019]

As is apparent from the above-described embodiments, according to the present invention, the drawback of the prior art that communication permission information cannot be managed collectively in a large organization is solved, and It is possible to determine and set, for each department in charge, information about which computer and which combination of computers outside the organization permits communication.

[Brief description of the drawings]

FIG. 1 is a conceptual diagram of establishing a communication path on a computer network using the present invention.

FIG. 2 is a processing flow chart of a connection availability judgment of a communication transfer control device using the present invention.

Claims (3)

[Claims] 1. A communication transfer control device for transferring communication between computers, having a mechanism for exchanging information between a plurality of communication transfer control devices for a determination condition or determination result as to whether or not communication between computers is permitted. Characterized communication transfer control device. 2. In a network system inside an organization connected to a wide area network, when communication with another organization is performed via the wide area network, which computer within the organization and which computer outside the organization are allowed to communicate. Information is exchanged between multiple communication transfer control devices, and the communication transfer control device in charge of the computer inside the organization determines whether or not the network inside the organization can be connected to the communication transfer control device that directly connects the wide area network. A network system characterized by having a mechanism for transmitting information. 3. In a network management system within an organization connected to a wide area network, when communication with another organization is performed via the wide area network, which computer within the organization and which computer outside the organization are allowed to communicate. Information is exchanged between multiple communication transfer control devices, and the communication transfer control device in charge of the computer inside the organization determines whether or not the network inside the organization can connect to the communication transfer control device that directly connects the wide area network. A network management method that communicates the judgment and uses the information to judge the connection at the festival.